CVE-2026-63197
traQ: XSS in the User Uploaded File Retrieval API
CVSS Score
7.3
EPSS Score
0.0%
EPSS Percentile
0th
traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.
| CWE | CWE-79 |
| Vendor | traptitech |
| Product | traq |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for traptitech traq
Be the first to know when new high vulnerabilities affecting traptitech traq are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
traPtitech / traQ
< 3.28.3